[ENHANCEMENT] allowedTools in MCP config

[ainthek]

Problem (one or two sentences)

MCP config only allows disabledTools, which is limiting and dangerous (blacklisting), instead it would be better to support also allowedTools to whitelist allowed tolls from dynamic MCP descriptors

Context (who is affected and when)

Users dealing with large MCPs with non granular design of endpoints.

Desired behavior (conceptual, not technical)

suport allowedTools in mcp config jsons

Constraints / preferences (optional)

whitelist if specified wins, blacklist then only filters whitelisted. If whitelist not specified behavior is the same as now.

Request checklist

• I've searched existing Issues and Discussions for duplicates
• This describes a specific problem with clear context and impact

Roo Code Task Links (optional)

No response

Acceptance criteria (optional)

No response

Proposed approach (optional)

No response

Trade-offs / risks (optional)

No response

[roomote]

I've analyzed this issue and here's my proposed implementation plan:

Summary

Add an optional allowedTools whitelist to MCP server configuration, complementing the existing disabledTools blacklist.

Behavior

• If allowedTools is not specified: all tools from the server are available (current behavior, unchanged).
• If allowedTools is specified: only the listed tools are allowed. Any tool not in the whitelist is treated as disabled.
• If both allowedTools and disabledTools are specified: the whitelist is applied first, then the blacklist filters from the whitelisted set (whitelist wins as the primary gate, blacklist further narrows).

Files to modify

1. src/services/mcp/McpHub.ts (~3 changes):

   • Add allowedTools: z.array(z.string()).optional() to BaseConfigSchema (next to disabledTools on line 72).
   • In the tool-fetching method (around lines 983-1019), read allowedTools from the config alongside disabledTools.
   • Update the enabledForPrompt logic: a tool is enabled only if (a) it's in allowedTools (when specified) AND (b) it's not in disabledTools.

2. src/services/skills/built-in-skills.ts: Update the MCP documentation strings to mention allowedTools as an optional config field.

3. src/services/mcp/__tests__/McpHub.spec.ts: Add test cases for:

   • allowedTools whitelist filtering (only listed tools are enabled)
   • Combined allowedTools + disabledTools behavior
   • Backward compatibility (no allowedTools means all tools allowed)

Why this approach is minimal and safe

• The existing infrastructure already uses enabledForPrompt as the single mechanism for tool filtering in prompts and the UI. No changes are needed in the prompt builder (getMcpServerTools), the types (McpTool), or the webview UI -- they all already respect enabledForPrompt.
• The config schema change is additive and optional, so existing configs remain valid.
• The toggleToolEnabledForPrompt UI toggle continues to work via disabledTools, which still applies on top of the whitelist.

Please mention @roomote in a comment saying that you approve this plan, and I'll proceed with the implementation.